Don't be casual about your security.
Take it seriously.
It's a vital part of your business.
And don't use PCI as a minimal checklist.
Understand your network or hire the people that can.
You want to get in and create layers of security so that
if an attacker gets past one obstacle,
they're going to run right into a brick wall somewhere else.
And as an attacker,
nothing's more frustrating than spending 50 hours to get through somebody's
firewall to run smack into an access control policy that says,
sorry, nobody from that domain can get in.
Because two things are doing happen then.
Number one is hopefully more alarms are going to go off.
You've got more chance of noticing the attacker to
call people like you into help, work at how they got in,
and get them out.
The second thing the attacker hopefully is going to do is just give up,
yeah, and go find some low-hanging fruit somewhere else at the next merchant.
And if you're a large enough merchant,
a lot of fun stuff we've been playing around with
lately is creating honeypot networks.
So you can give an,
you present an attacker something that looks like an easy target,
and you can go in and watch, almost in real time,
what they're doing and what their attack is against your network.
So if you have the resources to do things like that,
those can be very valuable sources of information.
So, I think this is one of the core lessons in protecting yourself.
Let's go back to the very start of what we talked about.
I guess many merchants, in fact,
every merchant I've ever spoken to that I talked about compromises and PFIs,
they go white.
All the blood drains from their face, and they look scared.
You were saying, and I want to finish on this really,
you were saying, but no, this is business as usual.
This is just stuff that happens.
Yeah.
It's going to be even terrifying maybe, if you get attacked.
You're worried about loss of income.
You're worried about what the fines can be.
You're worried about some shmuck, like me,
showing up and digging through your laundry drawer.
But, we've done this over and over again.
The attackers are not going to give up, so you can't give up either.
You've got to do the basics, at least,
to make yourself --- It's kind of like the analogy of your friend and the bear.
If you get attacked by a bear, you don't have to outrun the bear.
You have to outrun your friend, right?
That's right.
We're walking in the woods.
There's a bear.
I just have to run faster than you.
Exactly, and as a merchant, you've got to make sure you're not that easy target.
And the more you can make yourself secure,
the more an attacker's not going to want to bother with you.
Great.
And if you think you're under attack, well if you think under attack,
in fact, you are under attack.
Everyone's under attack.
If you think you're being compromised,
ring up your acquiring bank as soon as you can.
The longer you delay, the worse it's going to be, isn't it?
That is correct.
You want to get on top of it right away.
You want to be as transparent with your acquirer and your PFIs you can be.
The more transparent that you can be,
the less expensive your PFI investigation's going to be,
the less time it's going to take,
and the quicker we'll get you back to business as usual.
And from a European perspective, and I can't speak for American card brands,
but from a European card brand perspective,
I know the European card brands would look at the
more transparent and quick you were,
the less likely they were to take any action against you.
Exactly.
If they see that you're trying to do everything that you can and you
were just the victim of an unfortunate circumstance,
they're going to naturally be more lenient.
They want you back in business because you're making money for them too.
They're not in the business to put you out of business.
They want you in business,
but they do have to stop the bleeding of the cards because that,
there are billions of dollars lost.
Absolutely.
And I want to again, pull you back to one thing you said right at the start.
You said, you might only be a small merchant,
but the attack you might be suffering might be a
systematic attack against lots of people,
so it's worth reporting it,
and it's worth reporting it to the FBI because you will stop something bigger.
That's correct,
and it may be your systems that provide the critical link to stop
an attack that's going on all over the place.
That's great.
Aaron, thank you very much for your time.
This has been a really good conversation.
I hope if you're a merchant or a service provider,
you have a better idea of what happens when you get
compromised and the PFI comes in,
and also the sort of things you can do that will mean you
never actually have to meet Aaron in person.
Thank you.